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Having thus described the preferred embodiments, 
the invention is now claimed to be: 

1 . A method for backing up and restoring an 
application program including an application program 
5 configuration, the application program associated with a 
computer that includes an operating system with a common 
applications registry, the method comprising: 

creating an image backup of one or more storage media 
that store files associated with the application program; 
10 creating an initial application program backup of the 

application program including backing up files associated 
with the application program; 

periodically inventorying the one or more storage 
media to detect a change in a file associated with the 
15 application program; and 

responsive to a detected change, creating an update 
application program, backup of the application program 
including backing up files associated with the application 
program . 

20 2. The method as set forth in claim 1, wherein the 

creating of an update application program backup does not 
overwrite the initial application program backup or any 
previous update application program backup. 

3 . The method as set forth in claim 2 , wherein each 
25 application program backup is dated with a creation date. 

4. The method as set forth in claim 3, further 
including : 
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deleting an application program backup having an 
oldest creation date of a plurality of application program 
backups responsive to both of: 

a number of application program backups 
5 exceeding a selected number, and 

a time interval between a present date and 
the oldest creation date exceeding a selected 
time interval. 

5 • The method as set forth in claim 3 , further 
10 including: 

restoring the application program to a state 
corresponding to a selected creation date by copying 
information contained in an application program backup 
having the selected creation date onto the one or more 
15 storage media. 

6. The method as set forth in claim 5, wherein the 
restoring further includes : 

prior to the copying of information contained in the 
application program backup, copying the image backup onto 
20 the one or more storage media. 

7. The method as set forth in claim 1, further 
including: 

responsive to a detected change, categorizing the 
detected change as one of normal and suspicious; and 
25 responsive to a suspicious detected change, notifying 

a human of the suspicious detected change. 

8. The method as set forth in claim 7, further 
including : 
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responsive to a suspicious detected change, waiting 
to receive an approval from the human before creating the 
update application program backup. 

9- The method as set forth in claim 1, further 
including: 

repeating the steps of creating an initial 
application program backup, periodically inventorying the 
one or more storage media to detect a change in a file 
associated with the application program, and creating an 
update application program backup responsive to a detected 
change for at least a second application program. 

10. The method as set forth in claim 1, wherein the 
step of periodically inventorying the one or more storage 
media to detect a change in a file associated with the 

15 application program is performed responsive to a regular 
operation of the computer. 

11. The method as set forth in claim 1, wherein: 
the step of periodically inventorying further 

includes detecting a change in contents of a non-volatile 
20 memory which pertain to the application program; and 

the step of creating an update application program 
backup further includes recording the contents of the 
non-volatile memory which pertain to the application 
program . 

25 12. The method as set forth in claim 1, wherein the 

files associated with the application program include the 
common applications registry, and the steps of creating 
an initial application program backup and of creating an 
update application program backup each further include: 
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recording entries of the common application registry 
that pertain to the application program, 

13. The method as set forth in claim 1, further 
including : 

5 transferring the application program including the 

application program configuration to a second computer by 
copying information contained in an application program 
backup onto the one or more storage media that are 
accessible by the second computer. 

10 14 . A system for backing up and restoring an 

application program including an application program 
configuration, the application program associated with a 
computer that includes an operating system with a common 
applications registry, the system comprising: 

15 an application program backup software program for 

creating an application program backup of the application 
program including copies of files associated with the 
application program that reside on one or more storage 
media and copies of entries of the common applications 

20 registry pertaining to the application program, the 
application program backup software program assigning a 
creation date to each created application program backup 
corresponding to a date of creation thereof; 

a backup coordinating software program that invokes 

25 the application program backup software program to create 
an initial application program backup, periodically 
inventories the one or more storage media to detect one of 
a change in a file associated with the application program 
and a change, in an entry of the common applications 

30 registry pertaining to the application program, and 



invokes the application program backup software program to 
create an update application program backup responsive to 
a detected change; and 

a restore software program for restoring the 
application program to a state corresponding to a selected 
creation date by copying information contained in an 
application program backup having the selected creation 
date onto the one or more storage media. 

15. The system as set forth in claim 14, further 
including : 

an application program backup manager that deletes an 
application program backup responsive to: 

a number of application program backups 
exceeding a selected number, and 

a time interval between a present date and 
the creation date of the application program 
backup that exceeds a selected time interval. 

16. The system as set forth in claim 14, further 
including: 

an image backup software program for creating an 
image backup of the one or more storage media; and 

an image restore software program for copying the 
image backup onto the one or more storage media; 

wherein upon initiation of execution of the restore 
software program and responsive to a selected user input, 
the restore software program invokes the image restore 
software program prior to the copying of information 
contained in an application program backup onto the one or 
more storage media. 



17. The system as set forth in claim 14, wherein the 
computer is connected to a server system, and the 
application program backup is stored on the server system. 

18. The system as set forth in claim 14, further 
including: 

an application program backup database accessed by 
the application program backup software program and the 
backup coordinating software program that identifies the 
files and the entries of the common applications registry 
that pertain to the application program. 

19. The system as set forth in claim 18, further 
including : 

a second application program backup database accessed 
by the application program backup software program and the 
backup coordinating software program that identifies files 
and the entries of the common applications registry that 
pertain to a second application program, wherein the 
application program backup software program and the backup 
coordinating software program cooperate to periodically 
create an application program backup of the second 
application program responsive to a detected change in one 
of a file associated with the second application program 
and an entry of the common applications registry 
pertaining to the second application program. 

20. The system as set forth in claim 14, wherein the 
backup coordinating software program includes: 

a change classifier that classifies a detected change 
as one of a normal change and a suspicious change; and 

a user notification module that notifies a user of a 
detected suspicious change. 
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21. The system as set forth in claim 14, wherein: 
the backup coordinating software program further 
detects a change in contents of a non-volatile memory 
which pertain to the application program; and 

the application program backup software program 
records the contents of the non-volatile memory which 
pertain to the application program in the created 
application program backup. 



